3

I'm working on a module with the following objective:

Once a new Admin User Account is registered to the system an automated email should be sent to all Admin Users which have the Administrators role.

The purpose of this module is to automatically notify the Super Admin(s) that a new Admin User Account is added to the list of existing user accounts. I came up with this idea after reading this about signs of a compromised site. The module should flag unauthorized registration of Admin User Accounts.

I don't think there is such a feature available at the moment (correct me if I'm wrong). So I decided to try and create a module for this. I'm planning on making this module available for free in Magento Connect after it's finished. But since I'm not a hardcore backend developer I need some help to get there.

I want to hook to the admin_user_save_after event because this event will be triggered when creating a new Admin User (or would it be possible for malicious users to bypass this event?)

I have my module registered and my config.xml file in place. Now I need to work on my Observer.php file which is in the ../MyNamespace/MyModule/Model/ directory. But I'm not sure what code to put in my newAdminUserAlert method.

Whenever the admin_user_save_after event is triggered the method should:

  1. Check all existing Admin Users (that already existed before the admin_user_save_after event)
  2. Check the User Role of those Admin Users
  3. Retrieve the email address(es) of all existing Admin Users who have the Administrators role assigned to them
  4. Send an email to those "Super Admins"

At least I think, this is the way to go.

This is what I have got so far:

<?php
class MyNamespace_MyModule_Model_Observer
{
    public function newAdminUserAlert(Varien_Event_Observer $observer)
    {
        $adminUser = $observer->getEvent()->getObject();
    }

}

I do understand that it's quite much that I'm asking, but I also believe this functionality would help in making Magento safer.

Any input regarding this topic is appreciated (also if you think this is a bad idea), especially if you could help me write the Observer.php file.

3

This is a really good idea and I would use such a module. I won't write the code for you, but here are some thoughts and pointers.

  • unfortunately it is possible that an attacker creates an admin account without triggering the event. The shoplift exploit used SQL injection to get access to the database, then create an admin account there. I would suggest a cronjob that checks the admin accounts regularly instead. There is still no 100% guarantee that it works because the attacker might be able to disable the cronjob or manipulate your module before it alerts you, but it's better than nothing. It should be possible to set up the cronjob in the system crontab instead using Magento to make it harder to disable it. This means, we need a standalone php script in /shell additionally to the cron observer.
  • to detect changes, save the latest observed state to a file. That can be simply a list of all admin usernames. If the file already exists, use the admin user collection to get all current usernames and compare the difference
  • to find all "super admins" that should be notified, check if the role of each admin user has the "admin" privilege, i. e. full permissions. Exclude any new accounts of course

On second thought, such a tool would best be implemented outside of Magento and operate directly on the database, to minimize the risk of manipulation.

  • Thank you for your input Fabian! Checking the Admin User Accounts is sort of a routine for me when working on Magento stores. So it would be nice if there was an automated process running in the background that would flag registration of any new Admin Users. It's good to know that the admin_user_save_after event can be bypassed and therefore is not reliable. I like your approach of using a cronjob. Since I'm more of a frontend developer I don't think I can pull this off on my own, but I'll see if I can get someone to help me. To be continued... – ForMat Aug 26 '15 at 6:42
  • On second thought, it shouldn't even be a Magento module, I updated the answer just now. But you gave me some ideas. Will update here if I find some time to try it out. – Fabian Schmengler Aug 26 '15 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.